Deterministic encryption failing

[tanu3012]

I am trying to build a function to encrypt PII data in GBQ tables.

CREATE OR REPLACE FUNCTION `centralized-data-hub-reporting.USCentral1_dataset.ecrypt`(COL string) RETURNS BYTES AS (

DETERMINISTIC_ENCRYPT(

KEYS.KEYSET_CHAIN('gcp-kms://projects/centralized-data-hub-reporting/locations/us-central1/keyRings/bi-keyring/cryptoKeys/bi-key',b'CiQA1NQUSleANwuPFTwbTWnmcgYFTwfI+x/PYab......'),COL, ""));

The function is created but while using it's throwing error

SELECT

  name,USCentral1_dataset.ecrypt(name) as e_name

FROM

  centralized-data-hub-reporting.USCentral1_dataset.customer;

Steps I followed to create key,key_ring,cipher key are as follows:

1) gcloud kms keyrings create "bi-keyring" \

    --location "us-central1"

2)gcloud kms keys create "bi-key" \

  --location "us-central1" \

    --keyring "bi-keyring" \

    --purpose "encryption"

3)gcloud kms keys list \

    --location "us-central1" \

    --keyring "bi-keyring"

4)base64 - encoded AES key

gRXdkfRMrf+AN+G8D/dth7XD3Pb4G7M+5E7f3LZn7tw=

5) wrapped the AES using cloud KMS key

curl "https://cloudkms.googleapis.com/v1/projects/centralized-data-hub-reporting/locations/us-central1/key..." \

  --request "POST" \

  --header "Authorization:Bearer $(gcloud auth application-default print-access-token)" \

  --header "content-type: application/json" \

  --data "{\"plaintext\": \"gRXdkfRMrf+AN+G8D/dth7XD3Pb4G7M+5E7f3LZn7tw=\"}"

result:

{

  "name": "projects/centralized-data-hub-reporting/locations/us-central1/keyRings/bi-keyring/cryptoKeys/bi-key/cryptoKeyVersions/1",

  "ciphertext": "CiQA1NQUSleANwuPFTwbTWn.....",

  "ciphertextCrc32c": "2434165586",

  "protectionLevel": "SOFTWARE"

}